PT-2026-97720

CVE-2026-93662

Published

2026-09-24

Updated

2026-09-24

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5

Description An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom owner value. This allows a low-privileged user to access unpublished, pending, or trashed event and venue content from other accounts, which may include full street addresses.

Recommendations Update the plugin to version 7.4.5 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Karthik Ramakrishnan

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers